Administration Guide › Queries and Reports › How to Create a Query › Set Query Filters › Using Advanced Filters

Using Advanced Filters

You can use SQL-based advanced filters to qualify any function that queries the event log store, including narrowing queries, or adding additional qualifications to simple filters. The Advanced Filters interface helps you create the appropriate filter syntax by providing a form for entering logic columns, operators and values according to your filtering requirements.

Note: This section contains a brief overview of the SQL terms used in advanced filters. To use advanced filters to their full potential you need a thorough understanding of SQL and the Common Event Grammar.

The following SQL terms join multiple filter statements:

• And

  Displays the event information if all the joined terms are true.

• Or

  Displays the event information if any of the joined terms are true.

• Having

  Refines the terms of the main SQL statement by adding a qualifying statement. For example, you could set an advanced filter for events from specified hosts, and add a "having" statement to return only events of a specified severity level from those hosts.

The following SQL operators are used by advanced filters to create the basic conditions:

• Relational Operators

  Include the event information if the column bears the appropriate relation to the value you enter. The following relational operators are available:

  • Equal to
  • Not Equal to
  • Less than
  • Greater than
  • Less than or equal to
  • Greater than or equal to

  For example, using Greater than would include the event information from your chosen column if its value is greater than the value you set.

• Like

  Includes the event information if the column contains a pattern you enter, using % to set the pattern you want. For example, L% would return any values beginning with L, %L% would return any values with L included as neither first nor last letter.

• Not like

  Includes the event information if the column does not contain the pattern you specify.

• In set

  Includes the event information if the column contains one or more of the values in the quote-delineated set you enter. Multiple values in the set must be comma-separated.

• Not in set

  Includes the event information if the column does not contain one or more of the values in the quote-delineated set you enter. Multiple values in the set must be comma-separated.

• Matches

  Includes any event information that matches one or more of the characters that you enter, allowing you to search for key words.

• Keyed

  Includes any event information that is set as a key value during Report Server configuration. You can use key values to set business relevance or other organizational groups.

• Not Keyed

  Includes any event information that is not set as a key value during Report Server configuration. You can use key values to set business relevance or other organizational groups.